Resume PhotoRec without original photorec.ses

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
goodnewsgabriel
Posts: 4
Joined: 04 Apr 2017, 02:27

Resume PhotoRec without original photorec.ses

#1 Post by goodnewsgabriel »

:| :( :shock: Hi,
I have a USB with Porteus and for some reason, it doesn't save information when it is shutdown. I was recovering a 2tb hard drive with family pics and video. I don't have one hard drive big enough to save all the files. I had photorec save to a 150gb empty hard drive. When that was getting full, I did not know about being able to stop and resume with another drive, so I was copying the first recup.dir files to another disk I had with 70gb. My 150 gb drive was filing up again and I copied the recup files to a 1tb hard drive that only had 90gb left. After that finished, I was unable to unmount that hard drive and after a few hours of the file manager freezing every time I tried to unmount, i just unplugged the drive. Immediately, Porteus crashes and goes into text mode with a message about kernel panic. So,I had to restart linux. Testdisk had disapeard (I had downloaded it durring the session and it doesn't save it) along with the photorec.ses file. I don't have space in my hard drive to start over again. Is there a way to start where I left off. I notice that I can edit the photorec.ses file. Is there a way to start it where it left off? Do the numbers in the file names have any use for this type of operation? Please help. It's urgent. If not editing the photorec.ses file, is there another way to resume? Again, I do not have it for the original session.
Last edited by goodnewsgabriel on 03 May 2017, 03:10, edited 1 time in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Resume PhotoRec without photorec.ses

#2 Post by cgrenier »

PhotoRec 7.1-WIP is faster than previous versions. If necessary, see https://www.cgsecurity.org/testdisk.pdf on how to install it.
The filename of a recovered file contains a number, it's ((location of the data - location of the partition) / sector_size)
You can get partition location and sector size using "./testdisk_static -lu".

carewich
Posts: 1
Joined: 09 Apr 2017, 20:15
Contact:

Re: Resume PhotoRec without photorec.ses

#3 Post by carewich »

Thanks for sharing the latest version. I did not know that this version is better. I am going to download it, thanks!

goodnewsgabriel
Posts: 4
Joined: 04 Apr 2017, 02:27

Re: Resume PhotoRec without photorec.ses

#4 Post by goodnewsgabriel »

Ok, I downloaded the new version, but I still have the same problem. It starts a new scan because the original session file is missing. I'm an amateur at this. This is the session file for the new scan. I want to start the scan with at this file number f482376040.jpg not starting at the beginning. Is there a way to edit this new photorec.ses file to start scanning from this point?

#1493776047
/dev/sdb partition_i386,255,blocksize,4096,fileopt,everything,disable,asf,enable,bmp,enable,c4d,enable,flv,enable,gif,enable,jpg,enable,m2ts,enable,mov/mdat,enable,mov,enable,mp3,enable,mpg,enable,pdf,enable,png,enable,ra,enable,riff,enable,rm,enable,swf,enable,tif,enable,wv,enable,options,paranoid,keep_corrupted_file_no,wholespace,search,status=ext2_off,550032,inter
0-127631
127816-127847
128288-132687
132848-152143
152368-308983
309016-343839
343872-399487
399968-400367
401536-401543
403192-518535
518888-529319
529640-529647
530272-530279
530456-530463
530552-530559
530600-530607
530776-530783
530928-530935
530992-530999
531112-531119
532096-532103
532912-532919
533536-533543
534248-534255
534816-534823
535232-535247
535712-535719
536160-536167
536832-536839
537192-537199
540896-540903
543192-543199
543656-543663
544968-544975
545592-545599
546000-546007
546128-546135
546208-546215
546600-546607
546696-546703
546752-546759
546824-546831
547128-547135
547832-547839
548296-548303
548808-548815
549152-549159
549368-549375
549464-549471
549608-549615
549760-549767
549888-549895
550016-550023
550032-3907029167

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Resume PhotoRec without original photorec.ses

#5 Post by cgrenier »

It seems you didn't select a partition but the whole disk, so you can use

Code: Select all

#1493776047
/dev/sdb partition_i386,255,blocksize,4096,fileopt,everything,disable,asf,enable,bmp,enable,c4d,enable,flv,enable,gif,enable,jpg,enable,m2ts,enable,mov/mdat,enable,mov,enable,mp3,enable,mpg,enable,pdf,enable,png,enable,ra,enable,riff,enable,rm,enable,swf,enable,tif,enable,wv,enable,options,paranoid,keep_corrupted_file_no,wholespace,search,status=ext2_off,482376040,inter
482376040-3907029167

goodnewsgabriel
Posts: 4
Joined: 04 Apr 2017, 02:27

Re: Resume PhotoRec without original photorec.ses

#6 Post by goodnewsgabriel »

:D That is exactly what I was needing. That number change at the end of the commands. Thank you so much!

goodnewsgabriel
Posts: 4
Joined: 04 Apr 2017, 02:27

Re: Resume PhotoRec without original photorec.ses

#7 Post by goodnewsgabriel »

Also, yes, I was scanning the whole disk because the testdisk reported the FAT partition as bad. I accidentally overwrote it with NTFS.

Locked